Download Lnk: hxxp://musicoffaith.aavalue.com/mof/toolbar/mof-toolbar.cab File Name: mof-toolbar.cab VirusTotal Result: 12/32 (37.5%) AntiVir 7.6.0.81 2008.04.09 DR/Toolbar.A.34 Avast 4.8.1169.0 2008.04.09 Win32:Adware-gen BitDefender 7.2 2008.04.09 Trojan.Startpage.DLL ClamAV 0.92.1 2008.04.09 Adware.Toolbar-32 F-Prot 4.4.2.54 2008.04.08 W32/AdwareX.BF Fortinet 3.14.0.0 2008.04.09 Adware/SideSearch Ikarus T3.1.1.26 2008.04.09 Trojan.StartPage.DLL Kaspersky 7.0.0.125 2008.04.09 not-a-virus:AdTool.Win32.Toolbar.a NOD32v2 3014 2008.04.09 Win32/Adware.SideSearch Panda 9.0.0.4 2008.04.08 Spyware/7r7t Prevx1 V2 2008.04.09 Generic.Malware Webwasher-Gateway 6.6.2 2008.04.09 Trojan.Dropper.Toolbar.A.34 File Info: File size: 267859 bytes MD5...: 5f0fd16fb91c6153c75492f4c309f8fd SHA1..: e1ed24bc5e8b42d53ac7a5c00ca3074c05d72ce8 SHA256: b94ce6a57317b65d3451895191c7c84f44c52d5d4bce644d15cc05ddc5f4189f SHA512: 25f1ea47a0d1ddd461968cad20be82836125117a3a02898eb8a2a2971665211a 811a29b7cf9af41047de28c0c4d4919f955b57097d24e0e7086da6654b1b11c0 PEiD..: - PEInfo: - Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=9CE290F5D82D97F62A4B04DCDBC77900F42ECDAF This file carries one inf and one executable inside. File Name: mof-package.exe (MD5: C6706591D863CD1816B07A7BD0443014) File Name: mof-install.inf (MD5: ED8521A76FFBD3116D3490EB2BDAB934) VirusTotal Result: 15/32 (46.88%) AntiVir 7.6.0.81 2008.04.09 DR/Toolbar.A.34 Avast 4.8.1169.0 2008.04.09 Win32:Adware-gen BitDefender 7.2 2008.04.09 Trojan.Startpage.DLL ClamAV 0.92.1 2008.04.09 Adware.Toolbar-32 F-Prot 4.4.2.54 2008.04.08 W32/AdwareX.BF FileAdvisor 1 2008.04.09 Low threat detected Fortinet 3.14.0.0 2008.04.09 Adware/SideSearch Ikarus T3.1.1.26 2008.04.09 Trojan.StartPage.DLL Kaspersky 7.0.0.125 2008.04.09 not-a-virus:AdTool.Win32.Toolbar.a NOD32v2 3014 2008.04.09 Win32/Adware.SideSearch Panda 9.0.0.4 2008.04.08 Spyware/7r7t Prevx1 V2 2008.04.09 Generic.Malware Sunbelt 3.0.1032.0 2008.04.08 Music of Faith TheHacker 6.2.92.269 2008.04.09 Trojan/Downloader.VB.dht Webwasher-Gateway 6.6.2 2008.04.09 Trojan.Dropper.Toolbar.A.34 File Info: File Name: mof-package.exe File size: 273112 bytes MD5...: c6706591d863cd1816b07a7bd0443014 SHA1..: 15049c1547c25fc43ba5a7f6c4ddbbce9ccfefbc SHA256: 2f88346d0e8967dabaf3b0d18b4ebae7ed4920ae51c9e979ce7e81ead4c62fca SHA512: d206b23f081d0bc14d5f22aea368fcf5301f863449df0a121b99b40412023f97 6bac1cb4d70d6644d38426869fa4e4dc656e42b134ed75962cb28d11a2fb68c0 PE Header Signature: 00004550 Machine: 014C - Intel 386 Number of sections: 0005 Time/Date stamp: 423C2FEA Pointer to symbol table: 00000000 Number of symbols: 00000000 Size of optional header: 00E0 Characteristics: 010F Magic: 010B Linker version (major): 06 Linker version (minor): 00 Size of code: 00005C00 Size of initialized data: 00028600 Size of uninitialized data: 00000400 Address of entry point: 0000402D Base of code: 00001000 Base of data: 00007000 Image base: 00400000 Section alignment: 00001000 File alignment: 00000200 OS version (major): 0004 OS version (minor): 0000 Image version (major): 0000 Image version (minor): 0000 Sub system version (major): 0004 Sub system version (minor): 0000 Win32 version: 00000000 Size of image: 00039000 Size of headers: 00000400 Checksum: 00000000 Sub system: 0002 - Windows graphical user interface (GUI) subsystem DLL characteristics: 0000 Size of stack reserve: 00100000 Size of stack commit: 00001000 Size of heap reserve: 00100000 Size of heap commit: 00001000 Loader flags: 00000000 Number of RVA: 00000010 Base Data: Entry Point Address.: 0x40402d Time Date Stamp.....: 0x423c2fea (Sat Mar 19 13:58:02 2005) Machine Type.......: 0x14c (I386) PE Sections Section VirtSize VirtAddr PhysSize PhysAddr Flags .text 00005B32 00001000 00005C00 00000400 60000020 .rdata 000011C0 00007000 00001200 00006000 40000040 .data 000260D4 00009000 00000400 00007200 C0000040 .ndata 00008000 00030000 00000000 00000000 C0000080 .rsrc 00001000 00038000 00000800 00007600 40000040 Import table (libraries: 8) COMCTL32.dll (imports: 4) #17 ImageList_AddMasked ImageList_Destroy ImageList_Create KERNEL32.dll (imports: 62) ExpandEnvironmentStringsA GetEnvironmentVariableA lstrcmpiA CloseHandle SetFileTime GetFileAttributesA CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA lstrcatA SetCurrentDirectoryA CreateDirectoryA SetFileAttributesA Sleep GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess CopyFileA ExitProcess lstrcpynA GlobalFree GetWindowsDirectoryA GetTempPathA GetUserDefaultLangID GetDiskFreeSpaceA GlobalUnlock GlobalLock GlobalAlloc CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA SetEndOfFile UnmapViewOfFile MapViewOfFile CreateFileMappingA lstrcpyA lstrlenA GetSystemDirectoryA MulDiv DeleteFileA FindFirstFileA FindNextFileA FindClose SetFilePointer WaitForSingleObject GetExitCodeProcess SetErrorMode ReadFile GetModuleHandleA LoadLibraryA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile GetCommandLineA USER32.dll (imports: 60) ExitWindowsEx CharNextA DialogBoxParamA GetClassInfoA CreateWindowExA SystemParametersInfoA RegisterClassA EndDialog ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA LoadCursorA SetCursor CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow DispatchMessageA InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint PeekMessageA GDI32.dll (imports: 8) GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SetBkColor SelectObject ADVAPI32.dll (imports: 9) RegEnumValueA RegQueryValueExA RegSetValueExA RegCreateKeyExA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegEnumKeyA SHELL32.dll (imports: 6) ShellExecuteA SHBrowseForFolderA SHGetPathFromIDListA SHGetMalloc SHGetSpecialFolderLocation SHFileOperationA ole32.dll (imports: 3) OleInitialize OleUninitialize CoCreateInstance VERSION.dll (imports: 3) GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA When executed, opens up the url: hxxp://musicoffaith.aavalue.com/includes/dl_confirm/bundle_confirm.html?bannerid=15144 This url displays the following message: Congratulations! You have successfully installed the MusicOfFaith Toolbar! It installs the Music Of Faith toolbar in the browser. File Activity: Popup Window: Process Window Name Window Text explorer.exe Windows Internet Explorer csrss.exe End Program - Windows Internet Explorer This program is not responding. To return to Windows and check the status of the program, click Cancel. If you choose to end the program immediately, you will lose any unsaved data. To end the program now, click End Now. &End Now Cancel csrss.exe End Program - Windows Internet Explorer This program is not responding. To return to Windows and check the status of the program, click Cancel. If you choose to end the program immediately, you will lose any unsaved data. To end the program now, click End Now. &End Now Cancel Network Activit: TCP Scans: 27 IPs on Port 445 83.205.0.0/16 Process Info: Filename: mof-toolbar.exe MD5: e4f1fdaab5c3fff460611a27b8ab3080 SHA-1: 15e3eb6772e9753d4cd13ba753a76857672c0660 File Size: 257366 Bytes Command Line: C:\DOCUME~1\user\LOCALS~1\Temp\mof-toolbar.exe MD5: c6706591d863cd1816b07a7bd0443014 SHA-1: 15049c1547c25fc43ba5a7f6c4ddbbce9ccfefbc File Size: 273112 Bytes Command Line: C:\sample.exe Registry Reads: Key Name Value Times HKLM\Software\Microsoft\Windows\CurrentVersion ProgramFilesDir C:\Program Files 2 HKLM\SOFTWARE\CLASSES\.DLL dllfile 1 HKLM\SOFTWARE\CLASSES\CLSID\{0002DF01-0000-0000-C000-000000000046}\LOCALSERVER32 "C:\Program Files\Internet Explorer\IEXPLORE.EXE" 2 HKLM\SOFTWARE\CLASSES\CLSID\{2933BF90-7B36-11D2-B20E-00C04F983E60}\INPROCSERVER32 %SystemRoot%\system32\msxml3.dll 1 HKLM\SOFTWARE\CLASSES\CLSID\{2933BF90-7B36-11D2-B20E-00C04F983E60}\INPROCSERVER32 ThreadingModel Both 1 HKLM\Software\Microsoft\COM3 Com+Enabled 1 2 HKLM\Software\Microsoft\COM3 REGDBVersion 0x0f00000000000000 6 HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName ComputerName USER 2 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar firstURL http://musicoffaith.aavalue.com/bundles/initialize.html 2 Registry Monitored: HKLM\Software\Classes 1 Key Change,Value Change 4 HKLM\Software\Classes\CLSID 1 Key Change,Value Change 2 HKLM\Software\Microsoft\COM3 1 Key Change,Value Change 6 HKU 1 Key Change,Value Change 4 Registry Values Created: HKLM\Software\Classes\XBTB00501.IEToolbar.1 HKLM\Software\Classes\XBTB00501.IEToolbar.1\CLSID HKLM\Software\Classes\XBTB00501.IEToolbar HKLM\Software\Classes\XBTB00501.IEToolbar\CLSID HKLM\Software\Classes\XBTB00501.IEToolbar\CurVer HKLM\Software\Classes\CLSID\{FC0F30CD-E949-4148-884E-DC0F3D32EA46} HKLM\Software\Classes\CLSID\{FC0F30CD-E949-4148-884E-DC0F3D32EA46}\ProgID HKLM\Software\Classes\CLSID\{FC0F30CD-E949-4148-884E-DC0F3D32EA46}\VersionIndependentProgID HKLM\Software\Classes\CLSID\{FC0F30CD-E949-4148-884E-DC0F3D32EA46}\Programmable HKLM\Software\Classes\CLSID\{FC0F30CD-E949-4148-884E-DC0F3D32EA46}\InprocServer32 HKLM\Software\Classes\CLSID\{FC0F30CD-E949-4148-884E-DC0F3D32EA46}\TypeLib HKLM\Software\Classes\CLSID\{FC0F30CD-E949-4148-884E-DC0F3D32EA46}\Implemented Categories HKLM\Software\Classes\CLSID\ {FC0F30CD-E949-4148-884E-DC0F3D32EA46}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} HKLM\Software\Classes\CLSID\ {FC0F30CD-E949-4148-884E-DC0F3D32EA46}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} HKLM\Software\Classes\ToolBand.XBTB00501.1 HKLM\Software\Classes\ToolBand.XBTB00501.1\CLSID HKLM\Software\Classes\ToolBand.XBTB00501 HKLM\Software\Classes\ToolBand.XBTB00501\CLSID HKLM\Software\Classes\ToolBand.XBTB00501\CurVer HKLM\Software\Classes\CLSID\{CFC21563-BD46-4946-A49E-7AF6DEF17386} HKLM\Software\Classes\CLSID\{CFC21563-BD46-4946-A49E-7AF6DEF17386}\ProgID HKLM\Software\Classes\CLSID\{CFC21563-BD46-4946-A49E-7AF6DEF17386}\VersionIndependentProgID HKLM\Software\Classes\CLSID\{CFC21563-BD46-4946-A49E-7AF6DEF17386}\Programmable HKLM\Software\Classes\CLSID\{CFC21563-BD46-4946-A49E-7AF6DEF17386}\InprocServer32 HKLM\Software\Classes\CLSID\{CFC21563-BD46-4946-A49E-7AF6DEF17386}\TypeLib HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CFC21563-BD46-4946-A49E-7AF6DEF17386} HKLM\Software\Classes\TypeLib\{15BE9491-A776-42BD-BFC6-8F5978D83B9A} HKLM\Software\Classes\TypeLib\{15BE9491-A776-42BD-BFC6-8F5978D83B9A}\1.0 HKLM\Software\Classes\TypeLib\{15BE9491-A776-42BD-BFC6-8F5978D83B9A}\1.0\FLAGS HKLM\Software\Classes\TypeLib\{15BE9491-A776-42BD-BFC6-8F5978D83B9A}\1.0\0 HKLM\Software\Classes\TypeLib\{15BE9491-A776-42BD-BFC6-8F5978D83B9A}\1.0\0\win32 HKLM\Software\Classes\TypeLib\{15BE9491-A776-42BD-BFC6-8F5978D83B9A}\1.0\HELPDIR HKLM\Software\Classes\Interface\{F9BBC79A-077B-415B-82CE-15D1B8D7E93C} HKLM\Software\Classes\Interface\{F9BBC79A-077B-415B-82CE-15D1B8D7E93C}\ProxyStubClsid HKLM\Software\Classes\Interface\{F9BBC79A-077B-415B-82CE-15D1B8D7E93C}\ProxyStubClsid32 HKLM\Software\Classes\Interface\{F9BBC79A-077B-415B-82CE-15D1B8D7E93C}\TypeLib HKLM\Software\Classes\Interface\{745C62AE-7EB0-44C3-BA35-BA1808AB431B} HKLM\Software\Classes\Interface\{745C62AE-7EB0-44C3-BA35-BA1808AB431B}\ProxyStubClsid HKLM\Software\Classes\Interface\{745C62AE-7EB0-44C3-BA35-BA1808AB431B}\ProxyStubClsid32 HKLM\Software\Classes\Interface\{745C62AE-7EB0-44C3-BA35-BA1808AB431B}\TypeLib HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar HKLM\Software\Classes\XBTB00501.XBTB00501.1 HKLM\Software\Classes\XBTB00501.XBTB00501.1\CLSID HKLM\Software\Classes\XBTB00501.XBTB00501 HKLM\Software\Classes\XBTB00501.XBTB00501\CLSID HKLM\Software\Classes\XBTB00501.XBTB00501\CurVer HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Maxthon HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\XBTB00501.XBTB00501Toolbar Registry Values Modified: HKLM\SOFTWARE\CLASSES\CLSID\{CFC21563-BD46-4946-A49E-7AF6DEF17386} XBTB00501 Class HKLM\SOFTWARE\CLASSES\CLSID\{CFC21563-BD46-4946-A49E-7AF6DEF17386}\INPROCSERVER32 C:\PROGRA~1\MUSICO~1\Toolbar\MOF-TO~1.DLL HKLM\SOFTWARE\CLASSES\CLSID\{CFC21563-BD46-4946-A49E-7AF6DEF17386}\INPROCSERVER32 ThreadingModel Apartment HKLM\SOFTWARE\CLASSES\CLSID\{CFC21563-BD46-4946-A49E-7AF6DEF17386}\PROGID ToolBand.XBTB00501.1 HKLM\SOFTWARE\CLASSES\CLSID\{CFC21563-BD46-4946-A49E-7AF6DEF17386}\TYPELIB {15BE9491-A776-42bd-BFC6-8F5978D83B9A} HKLM\SOFTWARE\CLASSES\CLSID\{CFC21563-BD46-4946-A49E-7AF6DEF17386}\VERSIONINDEPENDENTPROGID ToolBand.XBTB00501 HKLM\SOFTWARE\CLASSES\CLSID\{FC0F30CD-E949-4148-884E-DC0F3D32EA46} IE Toolbar HKLM\SOFTWARE\CLASSES\CLSID\{FC0F30CD-E949-4148-884E-DC0F3D32EA46}\INPROCSERVER32 C:\PROGRA~1\MUSICO~1\Toolbar\MOF-TO~1.DLL HKLM\SOFTWARE\CLASSES\CLSID\{FC0F30CD-E949-4148-884E-DC0F3D32EA46}\INPROCSERVER32 ThreadingModel Apartment HKLM\SOFTWARE\CLASSES\CLSID\{FC0F30CD-E949-4148-884E-DC0F3D32EA46}\PROGID XBTB00501.IEToolbar.1 HKLM\SOFTWARE\CLASSES\CLSID\{FC0F30CD-E949-4148-884E-DC0F3D32EA46}\TYPELIB {15BE9491-A776-42bd-BFC6-8F5978D83B9A} HKLM\SOFTWARE\CLASSES\CLSID\{FC0F30CD-E949-4148-884E-DC0F3D32EA46}\VERSIONINDEPENDENTPROGID XBTB00501.IEToolbar HKLM\SOFTWARE\CLASSES\INTERFACE\{745C62AE-7EB0-44C3-BA35-BA1808AB431B} IToolHelper HKLM\SOFTWARE\CLASSES\INTERFACE\{745C62AE-7EB0-44C3-BA35-BA1808AB431B}\PROXYSTUBCLSID {00020424-0000-0000-C000-000000000046} HKLM\SOFTWARE\CLASSES\INTERFACE\{745C62AE-7EB0-44C3-BA35-BA1808AB431B}\PROXYSTUBCLSID32 {00020424-0000-0000-C000-000000000046} HKLM\SOFTWARE\CLASSES\INTERFACE\{745C62AE-7EB0-44C3-BA35-BA1808AB431B}\TYPELIB {15BE9491-A776-42BD-BFC6-8F5978D83B9A} HKLM\SOFTWARE\CLASSES\INTERFACE\{745C62AE-7EB0-44C3-BA35-BA1808AB431B}\TYPELIB Version 1.0 HKLM\SOFTWARE\CLASSES\INTERFACE\{F9BBC79A-077B-415B-82CE-15D1B8D7E93C} ISoftomateObj HKLM\SOFTWARE\CLASSES\INTERFACE\{F9BBC79A-077B-415B-82CE-15D1B8D7E93C}\PROXYSTUBCLSID {00020424-0000-0000-C000-000000000046} HKLM\SOFTWARE\CLASSES\INTERFACE\{F9BBC79A-077B-415B-82CE-15D1B8D7E93C}\PROXYSTUBCLSID32 {00020424-0000-0000-C000-000000000046} HKLM\SOFTWARE\CLASSES\INTERFACE\{F9BBC79A-077B-415B-82CE-15D1B8D7E93C}\TYPELIB {15BE9491-A776-42BD-BFC6-8F5978D83B9A} HKLM\SOFTWARE\CLASSES\INTERFACE\{F9BBC79A-077B-415B-82CE-15D1B8D7E93C}\TYPELIB Version 1.0 HKLM\SOFTWARE\CLASSES\TOOLBAND.XBTB00501 XBTB00501 Class HKLM\SOFTWARE\CLASSES\TOOLBAND.XBTB00501.1 XBTB00501 Class HKLM\SOFTWARE\CLASSES\TOOLBAND.XBTB00501.1\CLSID {CFC21563-BD46-4946-A49E-7AF6DEF17386} HKLM\SOFTWARE\CLASSES\TOOLBAND.XBTB00501\CLSID {CFC21563-BD46-4946-A49E-7AF6DEF17386} HKLM\SOFTWARE\CLASSES\TOOLBAND.XBTB00501\CURVER ToolBand.XBTB00501.1 HKLM\SOFTWARE\CLASSES\TYPELIB\{15BE9491-A776-42BD-BFC6-8F5978D83B9A}\1.0 Softomate 1.0 Type Library HKLM\SOFTWARE\CLASSES\TYPELIB\{15BE9491-A776-42BD-BFC6-8F5978D83B9A}\1.0\0\WIN32 C:\Program Files\MusicOfFaith\Toolbar\mof-toolbar.dll HKLM\SOFTWARE\CLASSES\TYPELIB\{15BE9491-A776-42BD-BFC6-8F5978D83B9A}\1.0\FLAGS 0 HKLM\SOFTWARE\CLASSES\TYPELIB\{15BE9491-A776-42BD-BFC6-8F5978D83B9A}\1.0\HELPDIR C:\Program Files\MusicOfFaith\Toolbar\ HKLM\SOFTWARE\CLASSES\XBTB00501.IETOOLBAR IE Toolbar HKLM\SOFTWARE\CLASSES\XBTB00501.IETOOLBAR.1 IE Toolbar HKLM\SOFTWARE\CLASSES\XBTB00501.IETOOLBAR.1\CLSID {FC0F30CD-E949-4148-884E-DC0F3D32EA46} HKLM\SOFTWARE\CLASSES\XBTB00501.IETOOLBAR\CLSID {FC0F30CD-E949-4148-884E-DC0F3D32EA46} HKLM\SOFTWARE\CLASSES\XBTB00501.IETOOLBAR\CURVER XBTB00501.IEToolbar.1 HKLM\SOFTWARE\CLASSES\XBTB00501.XBTB00501 Music of Faith Toolbar HKLM\SOFTWARE\CLASSES\XBTB00501.XBTB00501.1 Music of Faith Toolbar HKLM\SOFTWARE\CLASSES\XBTB00501.XBTB00501.1\CLSID {FC0F30CD-E949-4148-884E-DC0F3D32EA46} HKLM\SOFTWARE\CLASSES\XBTB00501.XBTB00501\CLSID {FC0F30CD-E949-4148-884E-DC0F3D32EA46} HKLM\SOFTWARE\CLASSES\XBTB00501.XBTB00501\CURVER XBTB00501.XBTB00501.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CFC21563-BD46-4946-A49E-7AF6DEF17386} XBTB00501 HKLM\Software\Microsoft\Internet Explorer\Toolbar {FC0F30CD-E949-4148-884E-DC0F3D32EA46} 0x00 HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\XBTB00501.XBTB00501Toolbar DisplayName Music of Faith Toolbar HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\XBTB00501.XBTB00501Toolbar UninstallString regsvr32 /u /s "C:\Program Files\MusicOfFaith\Toolbar\mof-toolbar.dll" HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN iexplore.exe 0 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar AlertMsg Alert HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar AutoComplete 0 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar DescriptiveText 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar ErrorMsg Error HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar KeepHistory 0 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar OpenNew 0 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar PopStop Music of Faith Toolbar has blocked a Pop-up window HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar RunSearchAutomatically 0 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar RunSearchDragAutomatically 0 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar ShowFindButtons 0 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar ShowHighlightButton 0 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar UpdateAutomatically 0 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar autoUpdateMsg New version ofMusic of Faith Toolbar is available. Would you like to download and install new version? HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar closeAllWindowsForUpdate All running IE Windows will be closed before updating the Music of Faith Toolbar. Continue? HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar connectionError Can't establish a connection. HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar contextMenuItemName Music of Faith Toolbar search HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar contextSearch http://search.musicoffaith.com/search.html?toolbar=%toolbar_id&keywords=%selection HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar corruptedMsg One of the XML files is corrupted or invalid. Press OK to uninstall. HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar firstTime 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar firstUrl http://musicoffaith.aavalue.com/bundles/initialize.html HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar lastVersionMsg You have the latest version of the Music of Faith Toolbar. HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar serverpath HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar toolbar_id {A9975454-A65A-4715-9597-0A3F42959860} HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar toolbar_version HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar uninstallMsg This will remove the Music of Faith Toolbar from your computer! Are you sure? HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar updateMsg This will try to update the Music of Faith Toolbar from the server. Continue? HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar updateUrl HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar urlAfterUninstall http://musicoffaith.aavalue.com/mof/toolbar/uninstall.html?toolbar_id=%toolbar_id HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar urlAfterUpdate HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\XBTB00501\Toolbar versionError Can not find current version information. Mutex: CTF.TimListCache.FMPDefaultS-1-5-21-1229272821-1004336348- 527237240-1003MUTEX.DefaultS-1-5-21-1229272821-1004336348- 527237240-1003 Files Deleted: C:\DOCUME~1\user\LOCALS~1\Temp\nsr1.tmp C:\DOCUME~1\user\LOCALS~1\Temp\nsp2.tmp Files Created: C:\DOCUME~1\user\LOCALS~1\Temp\mof-toolbar.exe C:\Program Files\MusicOfFaith\Toolbar\basis.xml C:\Program Files\MusicOfFaith\Toolbar\icons.bmp C:\Program Files\MusicOfFaith\Toolbar\mof-toolbar.crc C:\Program Files\MusicOfFaith\Toolbar\mof-toolbar.dll C:\Program Files\MusicOfFaith\Toolbar\mof.bmp C:\Program Files\MusicOfFaith\Toolbar\search.bmp C:\Program Files\MusicOfFaith\Toolbar\tb_settings.xml C:\Program Files\MusicOfFaith\Toolbar\version.txt Files Read: C:\DOCUME~1\user\LOCALS~1\Temp\mof-toolbar.exe C:\DOCUME~1\user\LOCALS~1\Temp\nsu3.tmp Files Modified: C:\DOCUME~1\user\LOCALS~1\Temp\nsu3.tmp C:\Program Files\MusicOfFaith\Toolbar\mof-toolbar.dll Folder reated: C:\Program Files\MusicOfFaith C:\Program Files\MusicOfFaith\Toolbar Memory Mapped Files: File Name C:\WINDOWS\system32\rpcss.dll Process Created: C:\DOCUME~1\user\LOCALS~1\Temp\mof-toolbar.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE -nohome hxxp://musicoffaith.aavalue.com/includes/dl_confirm/mof_confirm.html?bannerid=15144 C:\WINDOWS\system32\regsvr32 /s "C:\Program Files\MusicOfFaith\Toolbar\mof-toolbar.dll" Process Started: Filename: IEXPLORE.EXE MD5: 3ac2bc667da0af2c968e96e1630f5ab5 SHA-1: 7d1750c0cca742be4b00bfc08bfbc044e339f72c File Size: 625152 Bytes Command Line: "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome http://musicoffaith.aavalue.com/includes/dl_confirm/mof_confirm.html?bannerid=15144 Registry Values Created: HKU\S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\CTF\ TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\CTF\ TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\ 0x00000000 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\CTF\ TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\ 0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d} HKU\S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\CTF\ TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\CTF\ TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\ 0x00000000 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\CTF\ TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\ 0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d} HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA} HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA} HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\InprocServer32 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA} HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA} HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB} HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB} HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA} HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB} HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB} HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}\InprocServer32 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA} HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA} HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB} HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}\InprocServer32 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}\InprocServer32 Registry Values Created: HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\CTF\ TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\ 0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\CTF\ TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\ 0x00000000 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\CTF\ TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile HKU\S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\CTF\ TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\ 0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\CTF\ TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\ 0x00000000 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\CTF\ TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile HKU\S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA} HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\InprocServer32 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA} HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA} HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}\InprocServer32 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB} HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\InprocServer32 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA} HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA} HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}\InprocServer32 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB} HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}\InprocServer32 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA} HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\InprocServer32 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA} HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}\InprocServer32 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB} HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB} HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}\InprocServer32 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB} Registry Modified: HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\CTF\ TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\ 0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d} Enable 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\ Windows\CurrentVersion\Ext\Stats\ {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore Count 22 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\ Windows\CurrentVersion\Ext\Stats\ {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore Time 0xd8070100040011000f00210004003902 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\ Windows\CurrentVersion\Ext\Stats\ {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore Type 3 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA} Java Plug-in 1.3.0_03 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA} Java Plug-in 1.3.0_04 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA} Java Plug-in 1.3.1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA} Java Plug-in 1.3.1_01 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB} Java Plug-in 1.3.1_01 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA} Java Plug-in 1.3.1_02 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB} Java Plug-in 1.3.1_02 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA} Java Plug-in 1.3.1_03 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB} Java Plug-in 1.3.1_03 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA} Java Plug-in 1.3.1_04 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB} Java Plug-in 1.3.1_04 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA} Java Plug-in 1.3.1_05 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB} Java Plug-in 1.3.1_05 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA} Java Plug-in 1.3.1_06 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB} Java Plug-in 1.3.1_06 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA} Java Plug-in 1.3.1_07 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB} Java Plug-in 1.3.1_07 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA} Java Plug-in 1.3.1_08 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB} Java Plug-in 1.3.1_08 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA} Java Plug-in 1.3.1_09 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB} Java Plug-in 1.3.1_09 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA} Java Plug-in 1.3.1_10 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB} Java Plug-in 1.3.1_10 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA} Java Plug-in 1.3.1_11 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB} Java Plug-in 1.3.1_11 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA} Java Plug-in 1.3.1_12 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB} Java Plug-in 1.3.1_12 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA} Java Plug-in 1.3.1_13 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB} Java Plug-in 1.3.1_13 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA} Java Plug-in 1.3.1_14 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB} Java Plug-in 1.3.1_14 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA} Java Plug-in 1.3.1_15 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB} Java Plug-in 1.3.1_15 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA} Java Plug-in 1.3.1_16 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB} Java Plug-in 1.3.1_16 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA} Java Plug-in 1.3.1_17 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB} Java Plug-in 1.3.1_17 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA} Java Plug-in 1.3.1_18 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB} Java Plug-in 1.3.1_18 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA} Java Plug-in 1.3.1_19 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB} Java Plug-in 1.3.1_19 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA} Java Plug-in 1.3.1_20 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB} Java Plug-in 1.3.1_20 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA} Java Plug-in 1.3.1_21 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB} Java Plug-in 1.3.1_21 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA} Java Plug-in 1.3.1_22 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB} Java Plug-in 1.3.1_22 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA} Java Plug-in 1.3.1_23 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB} Java Plug-in 1.3.1_23 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA} Java Plug-in 1.3.1_24 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB} Java Plug-in 1.3.1_24 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA} Java Plug-in 1.3.1_25 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB} Java Plug-in 1.3.1_25 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA} Java Plug-in 1.3.1_26 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB} Java Plug-in 1.3.1_26 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA} Java Plug-in 1.3.1_27 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB} Java Plug-in 1.3.1_27 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA} Java Plug-in 1.3.1_28 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB} Java Plug-in 1.3.1_28 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA} Java Plug-in 1.3.1_29 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB} Java Plug-in 1.3.1_29 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA} Java Plug-in 1.3.1_30 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB} Java Plug-in 1.3.1_30 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB} Java Plug-in 1.4.0 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB} Java Plug-in 1.3.0_02 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Classes\CLSID\ {E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Internet Explorer\Main CompatibilityFlags 0 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Internet Explorer\Main FullScreen no HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Internet Explorer\Main Window_Placement 0x2c0000000000000001000000ffffffffffffffffffffffffffffffff5200 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Internet Explorer\Toolbar Locked 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Explorer\MountPoints2\ {d14d83ce-7d74-11dc-97e2-806d6172696f}\ BaseClass Drive HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Explorer\MountPoints2\ {d14d83cf-7d74-11dc-97e2-806d6172696f}\ BaseClass Drive HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Cache C:\Documents and Settings\user\Local Settings\Temporary Internet Files HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Cookies C:\Documents and Settings\user\Cookies HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Desktop C:\Documents and Settings\user\Desktop HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Favorites C:\Documents and Settings\user\Favorites HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders History C:\Documents and Settings\user\Local Settings\History HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ AutoDetect 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ IntranetName 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ProxyBypass 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ UNCAsIntranet 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}\INPROCSERVER32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}\InprocServer32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}\INPROCSERVER32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}\INPROCSERVER32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA} Java Plug-in 1.3.1_18 HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}\INPROCSERVER32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}\INPROCSERVER32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\INPROCSERVER32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}\INPROCSERVER32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\INPROCSERVER32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}\INPROCSERVER32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\INPROCSERVER32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}\INPROCSERVER32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}\INPROCSERVER32 ThreadingModel Apartment HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} Java Plug-in 1.4.0 HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}\InprocServer32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll HKU\S-1-5-21-1229272821-1004336348-527237240-1003_CLASSES\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}\InprocServer32 ThreadingModel Apartment Registry Values Read: Key Name Value Times HKLM\SOFTWARE\CLASSES\.HTM htmlfile 3 HKLM\SOFTWARE\CLASSES\.HTM PerceivedType text 1 HKLM\SOFTWARE\CLASSES\CLSID\{00020420-0000-0000-C000-000000000046}\INPROCSERVER32 oleaut32.dll 3 HKLM\SOFTWARE\CLASSES\CLSID\{00020420-0000-0000-C000-000000000046}\INPROCSERVER32 ThreadingModel Both 1 HKLM\SOFTWARE\CLASSES\CLSID\{00020424-0000-0000-C000-000000000046}\INPROCSERVER32 oleaut32.dll 1 HKLM\SOFTWARE\CLASSES\CLSID\{00020424-0000-0000-C000-000000000046}\INPROCSERVER32 ThreadingModel Both 1 HKLM\SOFTWARE\CLASSES\CLSID\{0002DF01-0000-0000-C000-000000000046}\LOCALSERVER32 "C:\Program Files\Internet Explorer\IEXPLORE.EXE" 3 HKLM\SOFTWARE\CLASSES\CLSID\{1C1EDB47-CE22-4BBB-B608-77B48F83C823}\INPROCSERVER32 C:\WINDOWS\system32\ieframe.dll 2 HKLM\SOFTWARE\CLASSES\CLSID\{1C1EDB47-CE22-4BBB-B608-77B48F83C823}\INPROCSERVER32 ThreadingModel Apartment 1 HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32 %SystemRoot%\system32\SHELL32.dll 1 HKLM\SOFTWARE\CLASSES\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\INPROCSERVER32 C:\WINDOWS\system32\msctf.dll 3 HKLM\SOFTWARE\CLASSES\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\INPROCSERVER32 ThreadingModel Apartment 1 HKLM\SOFTWARE\CLASSES\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\INPROCSERVER32 C:\Program Files\Microsoft Office\OFFICE11\msohev.dll 2 HKLM\SOFTWARE\CLASSES\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\INPROCSERVER32 ThreadingModel Apartment 1 HKLM\SOFTWARE\CLASSES\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\OLD ICON\HTMLFILE\DEFAULTICON C:\Program Files\Internet Explorer\IEXPLORE.EXE,-17 1 HKLM\SOFTWARE\CLASSES\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\INPROCSERVER32 C:\WINDOWS\system32\msimtf.dll 1 HKLM\SOFTWARE\CLASSES\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\INPROCSERVER32 ThreadingModel Apartment 1 HKLM\SOFTWARE\CLASSES\CLSID\{750FDF0E-2A26-11D1-A3EA-080036587F03}\INPROCSERVER32 %SystemRoot%\System32\cscui.dll 4 HKLM\SOFTWARE\CLASSES\CLSID\{750FDF0E-2A26-11D1-A3EA-080036587F03}\INPROCSERVER32 ThreadingModel Apartment 1 HKLM\SOFTWARE\CLASSES\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\INPROCSERVER32 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll 6 HKLM\SOFTWARE\CLASSES\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\INPROCSERVER32 ThreadingModel Apartment 2 HKLM\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\INPROCSERVER32 C:\WINDOWS\system32\ieframe.dll 8 HKLM\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\INPROCSERVER32 ThreadingModel Apartment 1 HKLM\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELLFOLDER WantsParseDisplayName 1 HKLM\SOFTWARE\CLASSES\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39} AppID {9BA05972-F6A8-11CF-A442-00A0C90A8F39} 1 HKLM\SOFTWARE\CLASSES\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\INPROCSERVER32 C:\WINDOWS\system32\ieframe.dll 1 HKLM\SOFTWARE\CLASSES\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\INPROCSERVER32 ThreadingModel Apartment 1 HKLM\SOFTWARE\CLASSES\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\INPROCSERVER32 C:\WINDOWS\system32\msctf.dll 2 HKLM\SOFTWARE\CLASSES\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\INPROCSERVER32 ThreadingModel Apartment 1 HKLM\SOFTWARE\CLASSES\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\INPROCSERVER32 C:\Program Files\Internet Explorer\ieproxy.dll 4 HKLM\SOFTWARE\CLASSES\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\INPROCSERVER32 ThreadingModel Both 1 HKLM\SOFTWARE\CLASSES\CLSID\{FC0F30CD-E949-4148-884E-DC0F3D32EA46} Music of Faith Toolbar 2 HKLM\SOFTWARE\CLASSES\DRIVE\SHELLEX\FOLDEREXTENSIONS\{FBEB8A05-BEEE-4442-804E-409D6C4515E9} DriveMask 32 1 HKLM\SOFTWARE\CLASSES\HTMLFILE\CLSID {25336920-03F9-11cf-8FD0-00AA00686F13} 1 HKLM\SOFTWARE\CLASSES\HTMLFILE\SHELLEX\ICONHANDLER {42042206-2D85-11D3-8CFF-005004838597} 2 HKLM\SOFTWARE\CLASSES\INTERFACE\{00020400-0000-0000-C000-000000000046}\PROXYSTUBCLSID32 {00020420-0000-0000-C000-000000000046} 1 HKLM\SOFTWARE\CLASSES\INTERFACE\{85CB6900-4D95-11CF-960C-0080C7F4EE85}\PROXYSTUBCLSID32 {00020424-0000-0000-C000-000000000046} 3 HKLM\SOFTWARE\CLASSES\INTERFACE\{85CB6900-4D95-11CF-960C-0080C7F4EE85}\TYPELIB {EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B} 2 HKLM\SOFTWARE\CLASSES\INTERFACE\{85CB6900-4D95-11CF-960C-0080C7F4EE85}\TYPELIB Version 1.1 2 HKLM\SOFTWARE\CLASSES\INTERFACE\{9BAB3405-EE3F-4040-8836-25AA9C2D408E}\PROXYSTUBCLSID32 {C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6} 1 HKLM\SOFTWARE\CLASSES\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0\0\WIN32 C:\WINDOWS\system32\stdole2.tlb 1 HKLM\SOFTWARE\CLASSES\TYPELIB\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0\WIN32 C:\WINDOWS\system32\ieframe.dll 2 HKLM\SOFTWARE\Microsoft\CTF\SystemShared CUAS 0 1 HKLM\SOFTWARE\Microsoft\CTF\TIP\\ {78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Item\ {5130A009-5540-4FCF-97EB-AAD33FC0EE09} Description Proofing 2 HKLM\SOFTWARE\Microsoft\CTF\TIP\\ {78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Item\ {7AE86BB7-262C-431E-9111-C974B6B7CAC3} Description Smart Tag 2 HKLM\SOFTWARE\Microsoft\CTF\TIP\\ {78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\Category\Item\ {C6DEBC0A-F2B2-4F17-930E-CA9FAFF4CD04} Description Reference 2 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings EnablePunycode 1 1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings UrlEncoding 0x00000000 2 HKLM\Software\Classes\CLSID\{42042206-2d85-11d3-8cff-005004838597}\InProcServer32 C:\Program Files\Microsoft Office\OFFICE11\msohev.dll 1 HKLM\Software\Classes\CLSID\{50d5107a-d278-4871-8989-f4ceaaf59cfc}\InProcServer32 C:\WINDOWS\system32\msimtf.dll 1 HKLM\Software\Classes\CLSID\{750fdf0e-2a26-11d1-a3ea-080036587f03}\InProcServer32 %SystemRoot%\System32\cscui.dll 1 HKLM\Software\Classes\CLSID\{871c5380-42a0-1069-a2ea-08002b30309d}\InProcServer32 C:\WINDOWS\system32\ieframe.dll 4 HKLM\Software\Classes\CLSID\{9ba05972-f6a8-11cf-a442-00a0c90a8f39}\InProcServer32 C:\WINDOWS\system32\ieframe.dll 1 HKLM\Software\Microsoft\COM3 Com+Enabled 1 2 HKLM\Software\Microsoft\COM3 REGDBVersion 0x0f00000000000000 76 HKLM\Software\Microsoft\CTF\SystemShared CUAS 0 6 HKLM\Software\Microsoft\Internet Explorer\AutoComplete\Client\ {807C1E6C-1D00-453f-B920-B61BB7CDD997} 2 HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INTERNET_SHELL_FOLDERS IEXPLORE.EXE 0 1 HKLM\Software\Microsoft\Internet Explorer\Toolbar {FC0F30CD-E949-4148-884E-DC0F3D32EA46} 0x00 2 HKLM\Software\Microsoft\Windows NT\CurrentVersion\IMM Ime File msctfime.ime 1 HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Offline Files {750fdf0e-2a26-11d1-a3ea-080036587f03} 1 HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content PerUserItem 1 1 HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies PerUserItem 1 1 HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History PerUserItem 1 1 HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Url History DaysToKeep 20 1 HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName ComputerName USER 2 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters WinSock_Registry_Version 2.0 2 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5 Num_Catalog_Entries 3 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5 Serial_Access_Num 4 2 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 DisplayString Tcpip 4 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 Enabled 1 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 LibraryPath %SystemRoot%\System32\mswsock.dll 2 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 ProviderId 0x409d05229e7ecf11ae5a00aa00a7112b 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 StoresServiceClassInfo 0 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 SupportedNameSpace 12 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 Version 0 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 DisplayString NTDS 4 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 Enabled 1 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 LibraryPath %SystemRoot%\System32\winrnr.dll 2 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 ProviderId 0xee37263b80e5cf11a55500c04fd8d4ac 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 StoresServiceClassInfo 0 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 SupportedNameSpace 32 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 Version 0 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 DisplayString Network Location Awareness (NLA) Namespace 4 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 Enabled 1 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 LibraryPath %SystemRoot%\System32\mswsock.dll 2 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 ProviderId 0x3a244266a83ba64abaa52e0bd71fdd83 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 StoresServiceClassInfo 0 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 SupportedNameSpace 15 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 Version 0 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9 Next_Catalog_Entry_ID 1012 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9 Num_Catalog_Entries 11 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9 Serial_Access_Num 4 2 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001 PackedCatalogItem %SystemRoot%\system32\mswsock. 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002 PackedCatalogItem %SystemRoot%\system32\mswsock. 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003 PackedCatalogItem %SystemRoot%\system32\mswsock. 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004 PackedCatalogItem %SystemRoot%\system32\rsvpsp.d 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005 PackedCatalogItem %SystemRoot%\system32\rsvpsp.d 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006 PackedCatalogItem %SystemRoot%\system32\mswsock. 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007 PackedCatalogItem %SystemRoot%\system32\mswsock. 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008 PackedCatalogItem %SystemRoot%\system32\mswsock. 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009 PackedCatalogItem %SystemRoot%\system32\mswsock. 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010 PackedCatalogItem %SystemRoot%\system32\mswsock. 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011 PackedCatalogItem %SystemRoot%\system32\mswsock. 1 HKLM\System\Setup SystemSetupInProgress 0 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Control Panel\Desktop\WindowMetrics Shell Icon Bpp 16 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Control Panel\Desktop\WindowMetrics Shell Icon Size 32 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\CTF\ TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\ 0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d} Enable 1 3 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\ Windows\CurrentVersion\Ext\Stats\ {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore Count 20 2 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings CertificateRevocation 0 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings DisableCachingOfSSLPages 0 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings EnableHttp1_1 1 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings EnableNegotiate 1 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings MimeExclusionListForCache multipart/mixed multipart/x-mixed-replace multipart/x-byteranges 4 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings SecureProtocols 160 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings WarnOnPost 0x01000000 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings WarnOnZoneCrossing 0 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Internet Explorer\LinksExplorer Docked 0 2 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Internet Explorer\Main AlwaysShowMenus 1 4 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Internet Explorer\Main CompatibilityFlags 0 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Internet Explorer\Main Enable Browser Extensions yes 4 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Internet Explorer\Main FullScreen no 2 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Internet Explorer\Main SearchMigrated 1 4 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Internet Explorer\Main Window_Placement 0x2c0000000000000001000000ffffffffffffffffffffffffffffffff5200 2 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Internet Explorer\SearchScopes DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 6 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Internet Explorer\SearchScopes Version 1 4 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} DisplayName @ieframe.dll,-12512 2 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} 2 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Internet Explorer\Security\P3Global Enabled 1 2 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Internet Explorer\Toolbar Locked 1 4 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser ITBar7Layout 0x130000000000000000000000300000001000000013000000010000000007 4 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ ShellState 0x2400000033880000000000000000000000000000010000000d0000000000 2 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced DontPrettyPath 0 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Filter 0 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Hidden 1 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced HideFileExt 0 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced HideIcons 0 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced MapNetDrvBtn 0 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced NoNetCrawling 0 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced SeparateProcess 0 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced ShowCompColor 1 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced ShowInfoTip 1 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced ShowSuperHidden 1 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced WebView 0 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\ {d14d83ce-7d74-11dc-97e2-806d6172696f}\ Data 0x000000005c005c003f005c0049004400450023004300640052006f006d00 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\ {d14d83ce-7d74-11dc-97e2-806d6172696f}\ Generation 1 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\ {d14d83cf-7d74-11dc-97e2-806d6172696f}\ Data 0x000000005c005c003f005c00530054004f00520041004700450023005600 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\ {d14d83cf-7d74-11dc-97e2-806d6172696f}\ Generation 1 7 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU MRUList feabdc 2 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU a cmd\1 4 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU b taskmgr\1 4 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU c sfc /purgecache\1 4 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU d regedit\1 4 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU e c:\exec\popupKiller.exe\1 4 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU f wab.exe\1 4 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Cache %USERPROFILE%\Local Settings\Temporary Internet Files 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Cookies %USERPROFILE%\Cookies 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Desktop %USERPROFILE%\Desktop 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Favorites %USERPROFILE%\Favorites 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders History %USERPROFILE%\Local Settings\History 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache Signature Client UrlCache MMF Ver 5.2 2 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Content CacheLimit 163410 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Content CachePrefix 2 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies CacheLimit 8192 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies CachePrefix Cookie: 2 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012007101520071022 CacheLimit 8192 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012007101520071022 CacheOptions 11 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012007101520071022 CachePath %USERPROFILE%\Local Settings\History\History.IE5\MSHist012007101520071022 2 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012007101520071022 CachePrefix :2007101520071022: 2 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012007101520071022 CacheRepair 0 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012007102220071029 CacheLimit 8192 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012007102220071029 CacheOptions 11 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012007102220071029 CachePath %USERPROFILE%\Local Settings\History\History.IE5\MSHist012007102220071029 2 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012007102220071029 CachePrefix :2007102220071029: 2 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012007102220071029 CacheRepair 0 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012007110120071102 CacheLimit 8192 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012007110120071102 CacheOptions 11 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012007110120071102 CachePath %USERPROFILE%\Local Settings\History\History.IE5\MSHist012007110120071102 2 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012007110120071102 CachePrefix :2007110120071102: 2 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012007110120071102 CacheRepair 0 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\UserData CacheLimit 1000 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\UserData CacheOptions 8 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\UserData CachePath %USERPROFILE%\UserData 2 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\UserData CachePrefix UserData 2 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\UserData CacheRepair 0 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\feedplat CacheLimit 8192 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\feedplat CacheOptions 0 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\feedplat CachePath %USERPROFILE%\Local Settings\Application Data\Microsoft\Feeds Cache 2 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\feedplat CachePrefix feedplat: 2 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\feedplat CacheRepair 0 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\History CacheLimit 8192 1 HKU\ S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\ Windows\CurrentVersion\Internet Settings\5.0\Cache\History CachePrefix Visited: 2 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 Flags 33 3 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 Flags 475 3 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 Flags 71 3 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 1001 1 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 1004 3 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 1201 3 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 1800 1 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 1804 1 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 1806 1 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 1E05 131072 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Flags 1 3 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 1001 3 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 1004 3 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 1200 3 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 1201 3 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 1405 3 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 1800 3 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 1803 3 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 1804 3 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 1806 3 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 1E05 65536 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Flags 3 3 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached {42042206-2D85-11D3-8CFF-005004838597} {0000010B-0000-0000-C000-000000000046} 0x401 0x01000000446b9c7c94948af52012c801 1 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached {871C5380-42A0-1069-A2EA-08002B30309D} {000214E6-0000-0000-C000-000000000046} 0x401 0x01000000310032003a893fef1312c801 4 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\Microsoft\Windows\CurrentVersion\Explorer\Advanced ListviewAlphaSelect 0 2 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\Microsoft\Windows\CurrentVersion\Explorer\Advanced ListviewShadow 0 2 HKU\S-1-5-21-1229272821-1004336348-527237240-1003\software\Microsoft\Windows\CurrentVersion\Explorer\Advanced ListviewWatermark 0 2 Registry Values Monitored: Key Name Watch subtree Notify Filter Count HKLM\Software\Classes 1 Key Change,Value Change 5 HKLM\Software\Classes\CLSID 1 Key Change,Value Change 2 HKLM\Software\Microsoft\COM3 1 Key Change,Value Change 6 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5 0 Key Change 1 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9 0 Key Change 1 HKU 1 Key Change,Value Change 19 Files Read: C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\Registration\R00000000000f.clb C:\WINDOWS\system32\MSHTML.DLL C:\WINDOWS\system32\ieframe.dll C:\WINDOWS\system32\shell32.dll C:\WINDOWS\system32\stdole2.tlb PIPE\lsarpc Files Modified: MountPointManager PIPE\lsarpc File System Control Communication: File Control Code Times PIPE\lsarpc 0x0011C017 20 Device Control Communication: File Control Code Times WMIDataDevice 0x00228144 6 shadow 0x00140FFB 1 IDE#CdRomQEMU_QEMU_CD-ROM________________________0.9.____#4d51303030302033202020202020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} 0x004D0008 1 MountPointManager 0x006D0008 2 STORAGE#Volume#1&30a96598&0&Signature95619561Offset7E00Length13F291800#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} 0x004D0008 1 MountPointManager Memory Mapped Files: File Name C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\MSHTML.DLL C:\WINDOWS\system32\en-US\IEFRAME.dll.mui C:\WINDOWS\system32\en-US\ieframe.dll.mui C:\WINDOWS\system32\ieframe.dll C:\WINDOWS\system32\rpcss.dll C:\WINDOWS\system32\shell32.dll C:\WINDOWS\system32\stdole2.tlb C:\WINDOWS\system32\winlogon.exe Mutex: CTF.TimListCache.FMPDefaultS- 1-5-21-1229272821-1004336348-527237240-1003MUTEX.DefaultS-1-5- 21-1229272821-1004336348-527237240-1003 Local\ZoneAttributeCacheCounterMutex MSCTF.Shared.MUTEX.AN Keyboard Monitored: Virtual Key Code Times VK_ESCAPE (27) 44 VK_LBUTTON (1) 27